Using AI safely with WordPress

Uncanny Agent, the AI assistant built into Uncanny Automator, can take real actions on your WordPress site: build and edit recipes, change posts and pages, and update users. That speed is the point, but it also means a mistake reaches your site as fast as a good change does. This article sets out the habits that protect your data, your configuration, and your live site while you work with it. The same advice applies to an AI app such as ChatGPT or Claude that you’ve connected to the site.

Core safety principles

Follow these four principles whenever an AI assistant can make changes to your site:

• Work on a staging site when you can: test changes on a staging copy of your site before applying them to the live one.
• Duplicate before you modify: don’t edit a running recipe or a critical WordPress record directly. Make a copy first.
• Keep backups within reach: make sure a recent backup exists before any significant change.
• Review before you approve: look at what Uncanny Agent plans to do before you let it act.

Staging and live sites

Your live site is not the place to experiment. Follow this workflow instead.

1. Use a staging site first

Test new recipes, significant configuration changes, and anything that affects users on a staging or development copy of your site. This matters most for recipes that involve:

• A Loop block that acts on many users or posts at once, or any other bulk change to users (these can’t be undone once they run)
• Email or notification actions
• Creating or deleting users, or changing their roles
• Payment or subscription changes
• Deleting content or making large structural changes

2. Turn off email on staging

When you test on staging, stop the site from sending email so a test doesn’t reach real users. Test the logic first, without the side effects.

3. Check the results on staging

Confirm the workflow behaves as you expect before you take it to the live site. Check the Automator logs, the records the recipe changed, and anything it produced.

4. Move to the live site with care

Once the recipe or configuration works on staging, replicate it on the live site. A recipe doesn’t need rebuilding: on staging, open it in the recipe builder and choose Download recipe JSON from the ⋮ More actions menu, then on the live site use the Import button on Automator > Recipes. The file leaves out the Authorization value of any webhook action, so enter it again on the live site. For other changes, use a migration tool or an export and import rather than rebuilding by hand.

Backups and duplicates

Before a change that would be hard to undo, make sure you can get back to where you started.

Changing an Automator recipe

When Uncanny Agent suggests changes to a recipe that is already running:

1. Duplicate the recipe first. Don’t edit the running version. In the recipe builder, choose Duplicate recipe from the ⋮ More actions menu, or click Duplicate under the recipe’s title on Automator > Recipes. The copy starts as Recipe off, so it doesn’t run while you work on it.
2. Test the copy. Leave the original switched on while you try out the changes on the copy.
3. Swap only once verified. When the copy works as it should, switch the original to Recipe off and the copy to Recipe on.

If something goes wrong, the original is intact and ready to switch back on.

Backing up WordPress records

Before any AI-assisted change to posts, pages, users, or settings:

• Know your backup status. Confirm that a recent backup exists and that you can restore it.
• Make a copy. For posts and pages, duplicate the item before changing it.
• Note the original state. If a backup isn’t an option, write down the current configuration so you can put it back by hand.

Full site backups

For significant changes, especially deactivating plugins, bulk changes to users, or structural changes, make a full site backup first with a backup plugin or your host’s backup tools, so you have a restore point.

Working safely with content, users, and plugins

Each kind of change has its own risks. These are the checks to make for each.

Posts, pages, and content

• Ask for a preview first. Ask Uncanny Agent to show you the planned changes before it applies them.
• Use revisions. WordPress keeps a revision history for posts and pages. If an edit goes wrong, restore an earlier revision.
• Check formatting and structure. An AI assistant can introduce formatting you didn’t expect, so look at the result on the page.

Users and user data

• Test with one user first. Before a bulk change, try it on a single user to confirm what happens.
• Avoid irreversible actions. Deleting users and removing their data is hard to undo. Use staging and backups rigorously here.
• Respect privacy. Collect and process only the user data you need, and tell users when personal information is involved.

Plugins and integrations

• Check what depends on a plugin. Deactivating or deleting a plugin stops the recipes that use its triggers or actions. See Having trouble? Read this.
• Test integrations on staging. Confirm that app connections, webhooks, and third-party integrations work before you rely on them on the live site.

Working with Uncanny Agent

Be specific about what you want

Clear instructions lead to safer results. Tell Uncanny Agent exactly what you want to achieve, which constraints matter, and what to avoid. A vague request can produce actions you didn’t expect.

Break large tasks into steps

For a large or complicated change, ask Uncanny Agent to outline the steps first. Review the plan, approve each stage, and work through it step by step rather than making one big change.

Ask for explanations

If Uncanny Agent proposes something you don’t fully understand, ask it to explain before you let it go ahead. Understanding what will happen helps you judge the risk.

Trust, but verify

Even when Uncanny Agent sounds confident, check the results: look at the affected records, test the workflow, and confirm the outcome matches what you expected. Reviewing what Uncanny Agent did explains the summary it gives after each task, and the AI activity tab at Automator > Logs lists what the AI apps you connected through mcp.automatorplugin.com did on your site. Work done by Uncanny Agent isn’t listed there.

Related: Tips for getting better results from Uncanny Agent, Reviewing what Uncanny Agent did, Troubleshooting Uncanny Agent, What can Uncanny Agent do?